GoDivert

A high-performance, pure Go implementation of the WinDivert and FastDivert(WIP) user-mode library.

GoDivert allows you to capture and inject network packets on Windows without the complexity of CGO or external C dependencies. It is designed for high-performance network monitoring, security, and traffic engineering.

Key Features

• 🚀 Zero CGO Dependency: Built entirely in pure Go using golang.org/x/sys/windows. No GCC or MinGW required.
• 🐹 Idiomatic Go: Designed with a Go-first mentality, featuring friendly error handling and structured types.
• 📦 Embedded Driver: Bundles WinDivert drivers directly into your binary using go:embed.
• ⚡ High Performance: Optimized driver interaction for low-latency packet processing.
• 🔍 Pure Go Filter Compiler: Includes a complete filter compiler implemented in Go.

Quick Start

package main

import (
	"github.com/one-api/godivert"
)

func main() {
	// Open driver with a filter
	divert, err := godivert.New("!loopback and (tcp or udp)", godivert.LayerNetwork, 0, 0)
	if err != nil {
		panic(err)
	}
	defer divert.Close()

	// Buffer for packet data
	packet := make([]byte, 2000)
	var addr godivert.Address

	// Recv Send Loop
	for i := 0; ; i++ {
		readLen, err := divert.Recv(packet, &addr)
		if err != nil {
			panic(err)
		}
		_, err = divert.Send(packet[:readLen], &addr)
		if err != nil {
			panic(err)
		}
	}
}

Important

This library requires Administrator Privileges to run as it interacts with the Windows kernel.

Examples

GoDivert comes with several real-world examples under the examples/ directory. These showcase how to use GoDivert for advanced network engineering, security, and performance analysis.

1. Network Bandwidth Limiter & Latency Shaper

Simulates poor network conditions (artificial latency, packet loss, and traffic rate-limiting) on specific IP/UDP/TCP traffic.

• Use Case: Testing multiplayer games or mobile APIs under bad network conditions (similar to a programmatic, lightweight CLI version of Clumsy).
• How to run:

  # Inject 100ms latency, 5% packet loss, and limit speed to 256 KB/s
  go run ./examples/bandwidth_limiter -latency 100 -loss 5.0 -bandwidth 256

2. DNS Sinkhole & Spoofing Firewall

A packet-level DNS firewall. Intercepts outbound DNS queries, parses the queried domain names, and blocks/spoofs queries matching an ad/tracking blocklist to 127.0.0.1 / :: instantly.

• Use Case: Building custom network-wide ad-blockers or security gateways without modifying DNS settings or starting a DNS server daemon.
• How to run:

  go run ./examples/dns_sinkhole

3. Live Process Connection & Traffic Flow Monitor

Monitors active TCP/UDP connections in real-time, resolves Windows process IDs (PIDs) to their process image names (e.g. chrome.exe, spotify.exe), and renders an interactive, colored terminal dashboard.

• Use Case: Gaining complete, light-weight process-level network traffic visibility without bulky packet-capture libraries.
• How to run:

  go run ./examples/flow_monitor

Testing

Run tests with:

go test ./...

Acknowledgments

Based on the WinDivert Project by Basil.

License & Contact

• License: This project is licensed under the MIT License. Copyright (c) 2026 github.com/one-api.
• WinDivert driver binaries are licensed under the LGPL-3.0.
• Contact: hello@one-api.net or file a GitHub Issue.